refactor(evidence): unify retained inputs across domains (#8299)

Declare logical Evidence sources once and resolve exact retained inputs through
shared application workflows across 20 composition tools. Preserve domain-owned
authentication, source closure, caller choices, coverage and resource admission.

Validation includes public CLI/MCP regressions, local Codex terra/high trials
and fresh-import real-artifact workflows. Measurements, failed attempts and
coverage limits are recorded in docs/verification/evidence-input-composition-2026-10-31.md.

Fixes #8293.
Fixes #8281.

Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)

src/cli/managedProjectGraphCommand.ts

@@ -4,7 +4,12 @@ import { projectManagedApplicationGraphEvidence } from "../application/managed/M
 import { CLI_COMMANDS } from "../cliCommandNames.js";
 import { parseCliJsonInput } from "../cliJsonInput.js";
 import { logCliCommand } from "../cliLogging.js";
-import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
+import { projectCliAnalysisResult } from "./projectCliAnalysisResult.js";
+import { withCommandCancellation } from "./commandCancellation.js";
+import {
+  evidenceBundleOption,
+  runEvidenceInputCommand,
+} from "./evidenceInputCommand.js";
 import type { Logger } from "pino";
 import type { CliInstance } from "./types.js";
 
@@ -21,15 +26,28 @@ export const registerProjectManagedApplicationGraph = (
         .string()
         .describe("Inline managed application graph JSON or JSON file path"),
     }),
-    run: ({ args }) =>
-      logCliCommand(logger, "project-managed-application-graph", async () => {
-        const input = await parseCliJsonInput(
-          args.inputJson,
-          "project-managed-application-graph",
-        );
-        if (!input.ok) return input.error;
-        const result = projectManagedApplicationGraphEvidence(input.value);
-        return result.ok ? result.value : projectAnalysisError(result.error);
-      }),
+    options: z.object({ evidenceBundle: evidenceBundleOption }),
+    run: ({ args, options }) =>
+      withCommandCancellation((signal) =>
+        logCliCommand(logger, "project-managed-application-graph", async () => {
+          const input = await parseCliJsonInput(
+            args.inputJson,
+            "project-managed-application-graph",
+            signal,
+          );
+          if (!input.ok) return input.error;
+          return runEvidenceInputCommand(
+            "project_managed_application_graph",
+            options.evidenceBundle,
+            signal,
+            (lookup) =>
+              Promise.resolve(
+                projectManagedApplicationGraphEvidence(input.value, lookup, {
+                  signal,
+                }),
+              ),
+          ).then(projectCliAnalysisResult);
+        }),
+      ),
   });
 };